arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/eu-dora-template.md

@@ -0,0 +1,197 @@
+# DORA Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:eu-dora`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:eu-dora` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Pillar | Current Maturity (L1–L5) | Required | Gap | Priority |
+|--------|------------------------|---------|-----|---------|
+| ICT Risk Management | [L1–L5] | L3+ | [Description] | 🔴/🟠/🟡 |
+| Incident Reporting (4h/72h/1m) | [L1–L5] | L4 | [Description] | 🔴 |
+| Resilience Testing | [L1–L5] | L3 | [Description] | 🟠 |
+| Third-Party Management | [L1–L5] | L3+ | [Description] | 🔴 |
+| Concentration Risk | [L1–L5] | L2 | [Description] | 🟠 |
+
+Maturity scale: L1 = Initial / L2 = Developing / L3 = Defined / L4 = Managed / L5 = Optimising
+
+---
+
+## 1. Entity Scoping (Article 2)
+
+### 1.1 In-Scope Entity Types
+
+| Entity Type | In Scope | Supervisory Authority (FR) |
+|------------|---------|---------------------------|
+| Credit institutions | ☐ | ACPR |
+| Payment institutions | ☐ | ACPR |
+| Electronic money institutions | ☐ | ACPR |
+| Investment firms | ☐ | AMF / ACPR |
+| Crypto-asset service providers (MiCA) | ☐ | AMF |
+| Insurance undertakings | ☐ | ACPR |
+| Insurance intermediaries (> 250 employees) | ☐ | ACPR |
+| Pension funds (> 15 members) | ☐ | ACPR |
+| Central counterparties (CCPs) | ☐ | AMF |
+| Trading venues | ☐ | AMF |
+| ICT third-party service providers | ☐ | ESA-designated oversight |
+| Credit rating agencies | ☐ | ESMA |
+
+### 1.2 Proportionality
+
+| Criterion | Assessment |
+|-----------|-----------|
+| Microenterprise (< 10 employees, < €2M turnover) | ☐ Yes — simplified regime may apply |
+| Simplified ICT risk framework eligible (Article 16) | ☐ Yes ☐ No |
+
+## 2. ICT Risk Management Framework (Articles 5–16)
+
+| Requirement | Article | Status | Gap |
+|-------------|---------|--------|-----|
+| ICT risk management framework documented and maintained | Art. 5 | ☐ | |
+| Management body accountability for ICT risk | Art. 5(2) | ☐ | |
+| ICT risk tolerance statement defined | Art. 6(8) | ☐ | |
+| Asset identification and classification | Art. 8 | ☐ | |
+| Protection and prevention measures | Art. 9 | ☐ | |
+| Detection mechanisms | Art. 10 | ☐ | |
+| Response and recovery plans | Art. 11 | ☐ | |
+| Backup policies and recovery procedures | Art. 12 | ☐ | |
+| Communication plan for ICT incidents | Art. 14 | ☐ | |
+| Learning and evolving — post-incident review | Art. 15 | ☐ | |
+
+## 3. ICT-Related Incident Management (Articles 17–23)
+
+### 3.1 Incident Classification
+
+| Criterion | Major Incident Threshold |
+|-----------|------------------------|
+| Clients affected | [Number or % of client base] |
+| Transaction volume affected | [Volume and value] |
+| Duration | [Hours of unavailability] |
+| Reputational impact | [Media, regulatory attention] |
+| Geographical spread | [Single / multi-member state] |
+| Economic impact | [Amount or % of capital] |
+
+**Incident classification procedure in place**: ☐ Yes ☐ No
+
+### 3.2 Reporting Timeline (Major ICT Incidents)
+
+| Report | Deadline | Recipient | Content |
+|--------|---------|-----------|---------|
+| Initial notification | **4 hours** after classification as major (max 24h after detection) | ACPR / AMF | Incident summary, impact assessment |
+| Intermediate report | **72 hours** after initial notification | ACPR / AMF | Updated details, preliminary root cause |
+| Final report | **1 month** after resolution | ACPR / AMF | Full root cause, impact, cross-border effects, remediation |
+
+### 3.3 Reporting Readiness
+
+| Capability | Status |
+|------------|--------|
+| Major incident classification criteria documented | ☐ |
+| 4-hour reporting capability established | ☐ |
+| ACPR/AMF reporting portal registered | ☐ |
+| Incident response team identified | ☐ |
+| Voluntary cyber threat reporting process defined | ☐ |
+
+## 4. Digital Operational Resilience Testing (Articles 24–27)
+
+| Testing Type | Frequency | Scope | Status |
+|-------------|-----------|-------|--------|
+| Vulnerability assessment | Annual | All in-scope ICT systems | ☐ |
+| Open-source analysis | Annual | Software components | ☐ |
+| Network security assessment | Annual | Network infrastructure | ☐ |
+| Gap analysis | Annual | Controls vs requirements | ☐ |
+| Source code review (where applicable) | Annual | Critical applications | ☐ |
+| Scenario-based tests | Annual | Business continuity scenarios | ☐ |
+| TLPT (Threat-Led Penetration Testing) | Every **3 years** | Critical systems (significant entities only) | ☐ |
+
+### 4.1 TLPT Requirements (Article 26) — Significant Entities Only
+
+| Requirement | Status |
+|-------------|--------|
+| Based on TIBER-EU framework | ☐ |
+| Certified external testers engaged | ☐ |
+| Scope defined with competent authority | ☐ |
+| Results shared with competent authority | ☐ |
+| Remediation plan prepared and executed | ☐ |
+
+## 5. ICT Third-Party Risk Management (Articles 28–44)
+
+### 5.1 Register of ICT Arrangements (Article 28)
+
+| Provider | Service | Criticality | Contractual Requirements Met | Last Review |
+|---------|---------|------------|---------------------------|------------|
+| [Cloud provider] | [IaaS/PaaS/SaaS] | ☐ Critical ☐ Non-critical | ☐ | [Date] |
+| [SaaS provider] | [Core system] | ☐ Critical ☐ Non-critical | ☐ | [Date] |
+
+### 5.2 Mandatory Contract Provisions (Article 30)
+
+All ICT contracts must include:
+
+- [ ] Service level descriptions with quantitative/qualitative performance targets
+- [ ] Notice periods and reporting obligations to financial entity
+- [ ] Data processing location (country/region)
+- [ ] Cooperation with supervisory authorities
+- [ ] Termination rights (including orderly exit)
+- [ ] Audit rights and right of access (including sub-contractor audits)
+- [ ] Business continuity provisions
+
+### 5.3 Critical ITPP Oversight (Article 31+)
+
+If using a provider designated as **critical ICT third-party provider** (CITPP) by ESAs:
+
+- [ ] Enhanced contractual requirements applied
+- [ ] Lead overseer cooperation established
+- [ ] Participation in ESA oversight activities committed
+
+### 5.4 Concentration Risk (Article 29)
+
+| Requirement | Status |
+|-------------|--------|
+| ICT concentration risk assessed | ☐ |
+| Over-reliance on single provider identified and managed | ☐ |
+| Multi-cloud or multi-provider strategy documented (if risk identified) | ☐ |
+| Exit strategy documented for each critical provider | ☐ |
+
+## 6. French Supervisory Authority Context
+
+| Authority | Role | DORA Powers |
+|-----------|------|------------|
+| ACPR | Supervises banks, insurance, payment institutions | Incident notification recipient; resilience testing oversight; ICT third-party register access |
+| AMF | Supervises investment firms, CCPs, trading venues | Same as ACPR for in-scope entities |
+| Banque de France | Central bank; systemic risk coordination | Coordination with ACPR; systemic risk monitoring |
+| ANSSI | National cybersecurity authority | Technical input on incidents; SecNumCloud guidance for cloud providers |
+
+### 6.1 ACPR DORA Implementation Notes
+
+- [ ] ACPR DORA circulaires reviewed
+- [ ] Pre-DORA ACPR ICT/cloud requirements supersession confirmed
+- [ ] French transposition specifics assessed
+
+## 7. Gap Analysis and Roadmap
+
+| Pillar | Gap Description | Priority | Owner | Deadline |
+|--------|----------------|---------|-------|---------|
+| ICT Risk Management | [Gap] | 🔴 High | [Role] | [Date] |
+| Incident Reporting | [Gap] | 🔴 High | [Role] | [Date] |
+| Resilience Testing | [Gap] | 🟠 Medium | [Role] | [Date] |
+| Third-Party Management | [Gap] | 🔴 High | [Role] | [Date] |
+| Concentration Risk | [Gap] | 🟠 Medium | [Role] | [Date] |
+
+---
+
+**Generated by**: ArcKit `/arckit:eu-dora` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/eu-dsa-template.md

@@ -0,0 +1,183 @@
+# EU Digital Services Act Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:eu-dsa`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:eu-dsa` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Obligation Area | Status | Critical Gaps |
+|----------------|--------|--------------|
+| Provider Classification | [Classified] | — |
+| Transparency Reporting | [Compliant / Partial / Gap] | [Count] |
+| Content Moderation | [Compliant / Partial / Gap] | [Count] |
+| Algorithmic Transparency | [Compliant / Partial / Gap] | [Count] |
+| Risk Assessment (VLOP/VLOSE) | [Compliant / Partial / N/A] | [Count] |
+| Data Access for Researchers | [Compliant / Partial / N/A] | [Count] |
+
+---
+
+## 1. Provider Classification (Article 2 and Chapter III)
+
+### 1.1 Service Type Determination
+
+| Service Type | Definition | Applicable |
+|-------------|-----------|-----------|
+| Mere conduit | Network access or transmission | ☐ |
+| Caching | Automatic, intermediate, temporary storage | ☐ |
+| Hosting | Storage of information provided by recipients | ☐ |
+| Online platform | Hosting + dissemination to the public (not micro/small) | ☐ |
+| Very Large Online Platform (VLOP) | Online platform with ≥ 45M average monthly EU users | ☐ |
+| Very Large Online Search Engine (VLOSE) | Search engine with ≥ 45M average monthly EU users | ☐ |
+
+**Classification**: [Service type]
+
+### 1.2 Size Thresholds
+
+| Threshold | Value | This Provider |
+|-----------|-------|--------------|
+| Micro/small enterprise | < 50 employees and < €10M turnover | ☐ (exempted from some obligations) |
+| Standard online platform | ≥ 50 employees or ≥ €10M turnover | ☐ |
+| VLOP / VLOSE | ≥ 45M average monthly EU active users | ☐ |
+
+> **Note**: Micro and small enterprises are exempt from certain obligations (e.g., online dispute settlement, statement of reasons for content moderation). Commission publishes formal VLOP/VLOSE designations.
+
+### 1.3 Designated VLOP/VLOSE Status
+
+| Provider | Designated | Designation Date |
+|---------|-----------|-----------------|
+| This provider | ☐ Yes ☐ No | [If yes: date] |
+
+Formally designated VLOPs/VLOSEs are supervised directly by the European Commission.
+
+## 2. General Obligations — All Intermediary Services (Chapter II)
+
+| Obligation | Article | Status | Gap |
+|-----------|---------|--------|-----|
+| Transparency reports published | Art. 15 | ☐ | |
+| Complaints-handling mechanism | Art. 20 | ☐ | |
+| Out-of-court dispute settlement | Art. 21 | ☐ | |
+| Cooperation with authorities upon lawful order | Art. 9-10 | ☐ | |
+| Single point of contact designated | Art. 11 | ☐ | |
+| Legal representative designated (if non-EU) | Art. 13 | ☐ | |
+| Terms of service clear and accessible | Art. 14 | ☐ | |
+
+## 3. Hosting Provider Obligations (Article 16)
+
+[Complete if provider stores content on behalf of users]
+
+| Obligation | Status |
+|-----------|--------|
+| Notice and action mechanism in place (report illegal content) | ☐ |
+| Illegal content reports acknowledged and processed | ☐ |
+| Reporters notified of decisions | ☐ |
+| Illegal content flagged to law enforcement if serious crime | ☐ |
+
+## 4. Online Platform Obligations (Articles 17–28)
+
+[Complete if classified as online platform — not micro/small enterprise]
+
+### 4.1 Content Moderation Transparency
+
+| Obligation | Article | Status |
+|-----------|---------|--------|
+| Terms of service restrictions clearly stated | Art. 14 | ☐ |
+| Statement of reasons provided for content restrictions | Art. 17 | ☐ |
+| Internal complaint-handling system | Art. 20 | ☐ |
+| Out-of-court dispute settlement | Art. 21 | ☐ |
+| Trusted flaggers programme | Art. 22 | ☐ |
+| Repeat infringer policy documented | Art. 23 | ☐ |
+| Dark patterns prohibited | Art. 25 | ☐ |
+| Advertising transparency — no profiling of minors | Art. 26 | ☐ |
+| Recommender systems transparency | Art. 27 | ☐ |
+
+### 4.2 Recommender Systems (Article 27)
+
+| Requirement | Status |
+|-------------|--------|
+| Recommender systems disclosed in terms of service | ☐ |
+| Main parameters explained to users | ☐ |
+| At least one option not based on profiling offered | ☐ |
+
+## 5. VLOP / VLOSE Additional Obligations (Chapter IV, Articles 33–43)
+
+[Complete only if designated VLOP or VLOSE by the Commission]
+
+### 5.1 Annual Risk Assessment (Article 34)
+
+| Systemic Risk Area | Assessment Required | Status |
+|-------------------|--------------------|-|
+| Dissemination of illegal content | ☐ | |
+| Actual or foreseeable negative effects on fundamental rights | ☐ | |
+| Civic discourse and electoral processes | ☐ | |
+| Public security | ☐ | |
+| Gender-based violence / protection of minors | ☐ | |
+
+### 5.2 Risk Mitigation Measures (Article 35)
+
+| Measure | Status |
+|---------|--------|
+| Adapting content moderation systems | ☐ |
+| Adapting recommender systems | ☐ |
+| Adapting advertising systems | ☐ |
+| Reinforcing internal processes (crisis protocols) | ☐ |
+| Cooperation with trusted flaggers | ☐ |
+
+### 5.3 Independent Audit (Article 37)
+
+| Requirement | Status |
+|-------------|--------|
+| Annual independent audit conducted | ☐ |
+| Audit report shared with Digital Services Coordinator | ☐ |
+| Audit methodology: ISAE 3000 or equivalent | ☐ |
+
+### 5.4 Algorithmic Transparency (Article 40)
+
+| Requirement | Status |
+|-------------|--------|
+| Access to recommender system data granted to researchers | ☐ |
+| Compliance repository publicly accessible | ☐ |
+| Non-profiling option for recommender systems | ☐ |
+
+### 5.5 Data Access for Researchers (Article 40)
+
+| Requirement | Status |
+|-------------|--------|
+| Vetted researcher access mechanism established | ☐ |
+| Data access protocol documented | ☐ |
+| Privacy-preserving data access implemented | ☐ |
+
+## 6. French Digital Services Coordinator — ARCOM
+
+| Aspect | Detail |
+|--------|--------|
+| DSC for France | ARCOM (Autorité de régulation de la communication audiovisuelle et numérique) |
+| ARCOM role | Supervises non-VLOP/VLOSE online platforms established in France |
+| Complaint mechanism | Recipients of French services can complain to ARCOM |
+| Enforcement | ARCOM can impose fines up to 6% of global annual turnover |
+| Cooperation | ARCOM participates in European Board for Digital Services |
+
+## 7. Gap Analysis and Action Plan
+
+| Gap | Article | Priority | Owner | Deadline |
+|-----|---------|---------|-------|---------|
+| [Gap description] | [Art. XX] | 🔴 High | [Role] | [Date] |
+
+---
+
+**Generated by**: ArcKit `/arckit:eu-dsa` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/eu-nis2-template.md

@@ -0,0 +1,196 @@
+# NIS2 Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:eu-nis2`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:eu-nis2` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Pillar | Status | Critical Gaps |
+|--------|--------|--------------|
+| Entity Scoping | [Essential / Important / Out of scope] | [Count] |
+| Governance | [Compliant / Partial / Gap] | [Count] |
+| Risk Management | [Compliant / Partial / Gap] | [Count] |
+| Incident Reporting | [Compliant / Partial / Gap] | [Count] |
+| Supply Chain | [Compliant / Partial / Gap] | [Count] |
+| Business Continuity | [Compliant / Partial / Gap] | [Count] |
+
+---
+
+## 1. Entity Scoping
+
+### 1.1 Sector Classification (Annex I — Essential / Annex II — Important)
+
+| Sector | Sub-sector | Annex | Applicable |
+|--------|-----------|-------|-----------|
+| Energy | Electricity, gas, oil, hydrogen | I | ☐ |
+| Transport | Air, rail, water, road | I | ☐ |
+| Banking | Credit institutions | I | ☐ |
+| Financial market infrastructure | Trading venues, CCPs | I | ☐ |
+| Health | Healthcare providers, EU reference labs | I | ☐ |
+| Drinking water | — | I | ☐ |
+| Wastewater | — | I | ☐ |
+| Digital infrastructure | IXPs, DNS, TLD, cloud, CDN, datacentres | I | ☐ |
+| ICT service management (B2B) | Managed service providers | I | ☐ |
+| Public administration | Central / regional government | I | ☐ |
+| Space | — | I | ☐ |
+| Postal and courier | — | II | ☐ |
+| Waste management | — | II | ☐ |
+| Chemicals | — | II | ☐ |
+| Food | — | II | ☐ |
+| Manufacturing (medical, computers, transport equipment) | — | II | ☐ |
+| Digital providers | Marketplaces, search engines, social networks | II | ☐ |
+| Research | — | II | ☐ |
+
+### 1.2 Size Thresholds
+
+| Criterion | Essential Entity | Important Entity |
+|-----------|----------------|-----------------|
+| Employees | > 250 | 50–250 |
+| Annual turnover | > €50M | €10–50M |
+| Balance sheet | > €43M | €10–43M |
+| Or: Critical infrastructure designation | — | — |
+
+**Entity classification**: ☐ Essential Entity | ☐ Important Entity | ☐ Out of scope
+
+### 1.3 National Competent Authority
+
+| Member State | NIS2 Authority | Contact |
+|-------------|---------------|---------|
+| France | ANSSI | cert.fr / anssi.gouv.fr |
+| Germany | BSI | bsi.bund.de |
+| Netherlands | NCSC-NL | ncsc.nl |
+| Spain | CCN-CERT / INCIBE | ccn-cert.cni.es |
+| Italy | ACN | acn.gov.it |
+| Belgium | CCB | ccb.belgium.be |
+| [Other] | [Authority] | [URL] |
+
+**Applicable authority**: [Name]
+
+## 2. Governance Obligations (Article 20)
+
+| Requirement | Status | Evidence |
+|-------------|--------|---------|
+| Management body approves cybersecurity risk management measures | ☐ | |
+| Management body oversees implementation | ☐ | |
+| Management body members trained in cybersecurity | ☐ | |
+| Management body personally liable for compliance | ☐ | |
+
+## 3. Risk Management Measures (Article 21)
+
+### 3.1 Minimum Security Measures
+
+| Measure | Article 21(2) | Status | Gap |
+|---------|--------------|--------|-----|
+| Policies on risk analysis and IS security | (a) | ☐ | |
+| Incident handling | (b) | ☐ | |
+| Business continuity and crisis management | (c) | ☐ | |
+| Supply chain security (ICT suppliers) | (d) | ☐ | |
+| Security in network and IS acquisition, development, maintenance | (e) | ☐ | |
+| Policies and procedures for effectiveness assessment | (f) | ☐ | |
+| Basic cyber hygiene and training | (g) | ☐ | |
+| Cryptography and encryption policies | (h) | ☐ | |
+| HR security, access control, asset management | (i) | ☐ | |
+| Multi-factor authentication (MFA) | (j) | ☐ | |
+| Secure communications (voice, video, text) | (j) | ☐ | |
+| Secure emergency communication systems | (j) | ☐ | |
+
+### 3.2 Proportionality Assessment
+
+| Factor | Assessment |
+|--------|-----------|
+| Entity size | [Large / Medium / Small] |
+| Risk exposure | [High / Medium / Low] |
+| Measures proportionate to risk | ☐ Yes ☐ No |
+| All-hazards approach applied | ☐ Yes ☐ No |
+
+## 4. Incident Reporting (Articles 23–24)
+
+### 4.1 Significant Incident Definition
+
+An incident is **significant** if it causes or could cause:
+
+- Severe operational disruption or financial loss
+- Impact on other natural or legal persons (physical, material, or non-material damage)
+
+### 4.2 Reporting Timeline
+
+| Report | Deadline | Recipient | Content |
+|--------|---------|-----------|---------|
+| Early warning | **24 hours** from awareness | National CSIRT + Competent Authority | Incident occurred, possibly malicious, possibly cross-border |
+| Incident notification | **72 hours** from awareness | National CSIRT + Competent Authority | Initial assessment, severity, indicators of compromise |
+| Intermediate report (if requested) | On request | Authority | Status update |
+| Final report | **1 month** after submission | National CSIRT + Competent Authority | Full description, type, root cause, applied mitigations, cross-border impact |
+
+### 4.3 Reporting Readiness
+
+| Capability | Status |
+|------------|--------|
+| 24-hour reporting capability established | ☐ |
+| CSIRT contact details known | ☐ |
+| Incident classification procedure documented | ☐ |
+| Reporting templates prepared | ☐ |
+| Crisis communication plan in place | ☐ |
+
+## 5. Supply Chain Security (Article 21(2)(d) + Article 22)
+
+| Requirement | Status | Notes |
+|-------------|--------|-------|
+| ICT supplier inventory maintained | ☐ | |
+| Supplier cybersecurity clauses in contracts | ☐ | |
+| Critical supplier risk assessments conducted | ☐ | |
+| ENISA ICT supply chain risk framework applied | ☐ | |
+| EU coordinated risk assessment outcomes reviewed | ☐ | |
+| 5G network equipment restrictions applied (if applicable) | ☐ | |
+
+## 6. Business Continuity (Article 21(2)(c))
+
+| Requirement | Status |
+|-------------|--------|
+| Business continuity plan documented | ☐ |
+| Backup and restoration procedures tested | ☐ |
+| Crisis management procedures defined | ☐ |
+| Recovery time objectives (RTO) defined | ☐ |
+| Recovery point objectives (RPO) defined | ☐ |
+
+## 7. Member State Specifics
+
+### 7.1 France (ANSSI)
+
+[Complete if operating under French jurisdiction]
+
+| Requirement | Status |
+|-------------|--------|
+| ANSSI sector-specific requirements (OIV/OSE) applied | ☐ |
+| CERT-FR incident notification portal registered | ☐ |
+| LPM Article 22 obligations assessed (if OIV) | ☐ |
+| ANSSI SecNumCloud evaluated for cloud services | ☐ |
+
+### 7.2 Other Member States
+
+[Add sections for each relevant jurisdiction]
+
+## 8. Gap Analysis and Roadmap
+
+| Gap | Article | Priority | Owner | Deadline |
+|-----|---------|---------|-------|---------|
+| [Gap description] | [Art. XX] | 🔴 High | [Role] | [Date] |
+
+---
+
+**Generated by**: ArcKit `/arckit:eu-nis2` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]